1Purpose and scope
This policy sets out the procedures and principles for the retention and destruction of personal data processed by Bayındır Ambalaj San. ve Tic. A.Ş. ("Bayındır Ambalaj") in its capacity as data controller, in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.
The policy covers all personal data processed by Bayındır Ambalaj, including that of employees, job applicants, business partners, suppliers, visitors and website users.
2Definitions
| Term | Description |
|---|---|
| Data subject | The natural person whose personal data is processed. |
| Recording medium | Any medium containing personal data processed by fully or partially automated means, or by non-automated means provided that it forms part of a data filing system. |
| Destruction | The erasure, destruction or anonymisation of personal data. |
| Periodic destruction | The ex officio destruction, at the intervals specified in this policy, of personal data whose retention period has expired. |
| Board | Personal Data Protection Board. |
3Recording media
| Medium | Description |
|---|---|
| Physical media | Paper and similar printed documents, files. |
| Local digital media | In-house servers (email, payroll, file server), fixed and portable disks. |
| Cloud and hosting environments | Encrypted internet-based servers used by the company but not located on its premises; the server hosting the website falls within this scope. |
4Security measures
Pursuant to Article 12 of the KVKK, the following measures are taken to prevent the unlawful processing of and access to personal data and to ensure its safeguarding:
- Administrative: confidentiality undertakings and data security training for employees; corporate policies on access, retention and destruction; data security clauses in contracts; prompt reporting of data security issues; minimising personal data as far as possible.
- Technical: network and application security, firewalls, up-to-date malware protection, authorisation and access control, regular and secure backups; on the website, an encrypted connection (HTTPS), form security verification and no third-party scripts loaded without consent.
- Audit: internal audits are carried out on the implementation of the KVKK and this policy; any shortcomings identified are remedied.
5Reasons requiring retention and destruction
Personal data is retained for as long as the conditions set out in Articles 5 and 6 of the KVKK continue to apply, such as the conclusion or performance of a contract, the establishment, exercise or protection of a right, compliance with legal obligations, express provision in the legislation, or legitimate interest.
Personal data is destroyed if any of the following occurs:
- the statutory provisions on which the processing is based are amended or repealed,
- the purpose of processing or retention no longer exists,
- where the processing is based on explicit consent, the data subject withdraws their consent,
- the data subject's request for erasure, destruction or anonymisation is accepted,
- the maximum retention period has expired and there is no reason justifying longer retention.
6Destruction methods
| Medium | Method |
|---|---|
| Physical | Blacking out (rendering illegible) or destruction with a document shredder. |
| Digital and cloud | Irrecoverable deletion using software; where necessary, overwriting or physically destroying the data medium. |
| Anonymisation | Removal of direct identifiers, local suppression, generalisation, data shuffling and perturbation; rendering the data incapable of being linked to the data subject. |
7Retention periods
| Data subject | Data category | Retention period |
|---|---|---|
| Visitor opening form pages | Session record (IP address, browser information) | 2 hours at most; then deleted automatically |
| All site visitors | Server access logs (IP address, date and time, page address, browser information) | The period prescribed by Law No. 5651 and related legislation |
| Visitor consenting to visit statistics | Google Analytics visit data (cookie ID, page views, device and approximate location information) | 14 months; then deleted automatically by Google |
| Person submitting a form | Data and attachments submitted via the quote request and contact forms | 1 year from the conclusion of the request; a request on which no action has been taken for 6 months is deemed concluded. Submissions marked as spam are deleted within 30 days. If it becomes a business relationship, the business partner period applies |
| Applicant | KVKK request and correspondence | 10 years from the conclusion of the request (limitation period) |
| Visitor (facilities) | Identity details, vehicle registration number and camera recordings collected on entry to the facilities | 1 year |
| Employees | Personnel file, payroll, and occupational health and safety data | 10 years from the end of the employment relationship; health reports and screening results 15 years |
| Job applicant | CV and application details | Up to 1 year |
| Business partner, supplier, customer | Identity, contact and financial information relating to the conduct of the business relationship | 10 years from the end of the relationship (Turkish Code of Obligations Art. 146, Turkish Commercial Code Art. 82) |
Where the relevant legislation provides for a longer period, a limitation period or a time limit for the forfeiture of rights, the period set out in the legislation applies as the maximum retention period.
8Periodic destruction
Personal data whose retention period has expired is destroyed in the first periodic destruction run after expiry. A destruction request from a data subject is concluded within thirty days at the latest.
Session records on the website are deleted automatically by the system when they expire, without waiting for periodic destruction.
9Updates
This policy may be updated in line with changes in legislation, decisions of the Board or technological developments. The current version is published on this page. For the data processed through the website and your rights, please see the Privacy notice.